cis-aws-database-3-11

name	cis-aws-database-3.11
description	Ensure to Regularly Review Security Configuration
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","rds","security-review","configuration","hardening"]
cis_id	3.11
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-3.4","cis-aws-database-3.5","cis-aws-database-3.6","cis-aws-database-3.7","cis-aws-database-3.9"]
prerequisites	[]
severity_boost	{}

3.11 Ensure to Regularly Review Security Configuration (Manual)

Description

This helps by reviewing the database factors from database engine, review instance details, security networks, encryption settings, audit logging, and authentication. By updating or removing a few things from these lists it helps tighten security and ensures that the users do not have excessive permissions.

Rationale

Regular security configuration reviews ensure that security controls remain effective and aligned with organizational security policies and best practices.

Impact

Updating the system and being updated with security configurations keeps everything secure and prevents it from an attack.

Audit Procedure

Using AWS Console

1. Sign into the AWS Management Console

   • Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon RDS Console

   • Navigate to the service using the Find Services search bar or by directly accessing the console at https://console.aws.amazon.com/rds/.

3. Select the RDS Instance

   • Choose the Amazon RDS instance you want to review the security configuration.
   • Click on the instance name to access its details page.

4. Review the Database Engine Documentation

   • Refer to the documentation provided by the database engine vendor (e.g., MySQL, PostgreSQL, Oracle, SQL Server) to understand the security best practices and configuration options specific to the database engine you use on Amazon RDS.
   • Review the vendor's guidelines for securing the database engine and associated components.

5. Review the Instance Details

   • In the instance details page, review the configuration settings related to security.
   • Security group associations: Ensure the appropriate security groups are assigned to the RDS instance to control inbound and outbound traffic.
   • IAM database authentication: Verify if IAM database authentication is enabled for enhanced security.
   • Encryption at rest: Confirm if encryption at rest is enabled using either AWS-managed keys or customer-managed keys.
   • Encryption in transit: Check if SSL/TLS encryption is enabled for secure data transmission.
   • Backup and retention: Review the automated backup settings and retention period to ensure data recovery capability.

6. Review Database User Privileges